Comment by nkobeissi

Of course, I was only referring to vulnerabilities I could verify are real.

Steve was paid two separate bug bounties and invited to a Cryptocat hackathon in NYC. I also consider him a friend and never heard a complaint from him regarding the project's disclosure policies.